682168 - TI: "Assertion failure: containsSlot(slot),"

Status: RESOLVED DUPLICATE of bug 680951

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(o) {
    o.valueOf();
    o.__defineSetter__('valueOf', function(){});
}
for (var i = 0; i < 4; i++) {
  f(arguments.__proto__);
}

asserts js debug shell on JM changeset d60ffe67a13f with -m, -a and -n at Assertion failure: containsSlot(slot)

Comment 1

[Brian Hackett [Laid off!]]

After fixing the v8-deltablue regression caused by bug 680951, this assert showed up in one of the jit-tests so I fixed it in 9a145389d570.  The bug 680951 patch had insufficient filtering for when the slot on an object's native property can be accessed, and would try to get an invalid slot from properties on objects that have a custom setter but no custom getter.